The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.
PUBLISHED5.2CWE-1023
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
Problem type
Affected products
PHP Group
PHP
< 8.2.34 - AFFECTED
< 8.3.35 - AFFECTED
< 8.4.26 - AFFECTED
< 8.5.11 - AFFECTED
References
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-91768Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-91768",
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"dateUpdated": "2026-09-25T21:07:30.950Z",
"dateReserved": "2026-09-15T00:42:30.045Z",
"datePublished": "2026-09-25T21:07:30.950Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php",
"dateUpdated": "2026-09-25T21:07:30.950Z"
},
"title": "IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)",
"descriptions": [
{
"lang": "en",
"value": "The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so <code>listen.allowed_clients</code> matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.</p>"
}
]
}
],
"affected": [
{
"vendor": "PHP Group",
"product": "PHP",
"packageName": "PHP-FPM",
"defaultStatus": "unaffected",
"versions": [
{
"version": "8.2.*",
"status": "affected",
"versionType": "semver",
"lessThan": "8.2.34"
},
{
"version": "8.3.*",
"status": "affected",
"versionType": "semver",
"lessThan": "8.3.35"
},
{
"version": "8.4.*",
"status": "affected",
"versionType": "semver",
"lessThan": "8.4.26"
},
{
"version": "8.5.*",
"status": "affected",
"versionType": "semver",
"lessThan": "8.5.11"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-1023",
"cweId": "CWE-1023",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637",
"tags": [
"vendor-advisory"
]
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"value": "@l8BL (GitHub)",
"type": "reporter"
},
{
"lang": "en",
"value": "@OSTIF-Derek (GitHub)",
"type": "reporter"
},
{
"lang": "en",
"value": "Ilia Alshanetsky",
"type": "reporter"
},
{
"lang": "en",
"value": "Alexandre Daubois",
"type": "remediation developer"
},
{
"lang": "en",
"value": "Arnaud Le Blanc",
"type": "remediation reviewer"
},
{
"lang": "en",
"value": "Jakub Zelenka",
"type": "remediation reviewer"
}
]
}
}
}